TCLBANKER: How a Brazilian Banking Trojan Targets 59 Platforms Without Malware Signatures
TCLBANKER Brazilian banking trojan targets 59 platforms via WhatsApp/Outlook worm. Learn how it steals credentials, evades EDR, and what developers must im
TCLBANKER: How a Brazilian Banking Trojan Targets 59 Platforms Without Malware Signatures
Threat hunters at Elastic Security Labs have documented a previously unknown Brazilian banking trojan dubbed TCLBANKER that's actively compromising credentials across 59 distinct banking, fintech, and cryptocurrency platforms without deploying traditional malware signatures to victim systems.
The trojan is noteworthy not for sophistication but for breadth: it targets every major banking ecosystem in Brazil plus cryptocurrency exchanges, payment processors, and mobile banking apps that developers rarely think of as attack surfaces.
What makes TCLBANKER dangerous to security teams is that it spreads via SORVEPOTEL, a worm framework that propagates through WhatsApp and Outlook with zero interaction required—just opening a message can trigger infection.
The Attack Surface They're Exploiting
TCLBANKER doesn't steal credentials directly. Instead, it:
1. Intercepts session tokens from 59 banking platforms by monitoring clipboard, browser history, and running processes
2. Maintains persistent access through a dropper mechanism that survives browser updates and operating system patches
3. Exfiltrates with zero bank detection because the trojan mimics legitimate mobile app traffic patterns
Analysis shows TCLBANKER successfully harvested credentials from:
- Traditional banks (Banco do Brasil, Itaú, Bradesco variants)
- Digital banks (Nubank, Inter, Magalu)
- Cryptocurrency exchanges (Binance Brazil, Foxbit, Mercado Bitcoin)
- B2B payment services (Stripe Brazil integrations, Pagar.me)
- Insurance and investment apps (XP, Clear, Rico)
In 73% of TCLBANKER samples analyzed, the malware persisted for 4-8 weeks before credential use, meaning victims weren't locked out—money was being transferred gradually to avoid fraud detection thresholds.
Why Traditional EDR Fails Here
Most endpoint detection and response (EDR) tools focus on process injection, registry modification, and network beacon patterns. TCLBANKER bypasses all three:
- No process injection: It lives entirely in user memory, running as child process of legitimate Windows services
- No registry touches: Configuration is stored in environment variables and Windows clipboard history
- No C2 domains: Command and control happens via WhatsApp Business API, which proxies through legitimate Meta infrastructure
Filesystem scans miss it. Network monitoring misses it. But keyboard loggers and clipboard monitors see everything.
Defense for Financial Developers
For API developers integrating with banking platforms:
- Audit token storage: Session tokens for banking APIs should never be stored in browser localStorage, environment variables, or clipboard. Use encrypted secure storage only.
- Implement token rotation: Banking APIs should expire tokens every 15 minutes, not daily. TCLBANKER relies on long-lived sessions.
- Add behavioral verification: Implement step-up authentication (SMS, push notification) when a token is used from a new device or unusual location, even if the token is valid.
- Monitor for clipboard theft: Use Windows API auditing to detect repeated clipboard reads from non-standard processes. TCLBANKER makes 300+ clipboard reads during a typical infection.
For financial institutions:
- Implement out-of-band verification: When a transaction exceeds $500, send SMS/push to registered phone number (not the device being used). TCLBANKER can't intercept this.
- Deploy impossible-travel detection: Flag transactions from geographic locations that are physically impossible to reach from the previous transaction in <4 hours.
- Require multi-sig for transfers: For accounts above risk thresholds, require two separate credentials (user + backup device) to approve transfers.
For security teams:
- Deploy Outlook and WhatsApp monitoring: SORVEPOTEL's propagation vector means breach detection starts in email/messaging logs. Monitor for unusual forwarding rules or message deletions.
- Track clipboard history: Enable Windows clipboard history auditing (
wevtutil.exe) and alert on repeated reads by non-standard processes.
- Sandbox WhatsApp documents: In corporate environments, disable file downloads in WhatsApp Business or require manual approval from security team.
TCLBANKER is particularly dangerous to developers because it targets the credential supply chain—the place where tokens flow from user auth to API integration. Standard malware detection misses it, but token-aware monitoring catches it immediately.
The broader lesson: In 2026, a single trojan can target 59 banking platforms simultaneously because the underlying attack (token interception) is platform-agnostic. Defense needs to shift from malware signatures to credential behavior analysis.